15 posts tagged with bug bounty.
CVE-2026-39534 was a custom-MVC dispatcher in WP Directory Kit that took a method name from POST and called it. No authentication, no nonce, no model allowlist. POST a model name, get the rows back. How the dispatcher pattern hides this class of bug and a checklist to find it in any plugin that ships its own MVC.
Read more →
CVE-2026-39511 was an unauthenticated SQL injection in the WP Photo Album Plus plugin. The query went through wpdb::prepare() correctly and then through stripslashes() right after, deleting the very escapes prepare() had just added. How the anti-pattern works, the exploitable payload and a checklist to grep your own plugin source for the same shape.
Read more →
The JavaScript bundle gave you the frontend's idea of the API. The six steps below give you the backend's reality. Version probing, method expansion, parameter discovery, auth boundary checks, response signal.
Read more →
Opening a stranger's bundled JavaScript for the first time. What I grep for, in what order and why. A practical follow-up to why you should not skip JS files at all.
Read more →
CVE-2025-4392 was an unauthenticated stored XSS in the Shared Files plugin. A sanitizer that only ran for SVGs and silently passed everything else through. How the gate made the function's name a lie, and a checklist to grep your own plugin source for the same pattern.
Read more →
A walkthrough of CVE-2025-3769, an IDOR in the LatePoint plugin that exposed customer data from about 100K WordPress sites. How I found it, the code-review pattern behind it and a checklist for auditing WordPress plugins yourself.
Read more →
Attackers don't follow your scope. Limited bug bounty programs protect you from findings while leaving your real attack surface wide open. Here's why wide scopes and recon matter.
Read more →
The best vulnerabilities aren't on the main domain. Here's why wildcard scopes beat limited ones and how going wide leads to the findings that actually matter.
Read more →
Running automated scans while ignoring JavaScript files means missing the real gold. Here's how reading JS files led to full admin access on a HackerOne target.
Read more →
Technical expertise matters, but if you want your findings fixed, you need to speak your audience's language. Here's how to translate security issues into business decisions.
Read more →
How a well-timed DNS change can bypass SSRF filters and turn a blocked vulnerability into full internal network access.
Read more →
Sometimes a single case change in a URL path is enough to bypass 401/403 errors. Here's why this edge case works and when to test for it.
Read more →
A development endpoint that shouldn't exist led to full remote code execution. Here's how thinking about impact turned one finding into a critical chain.
Read more →
One character in a URL parameter exposed full database credentials and turned into a $2,000 double critical finding. Here's what happened.
Read more →
Bug bounty can drain you if you approach it wrong. After 8 years and 1,000+ vulnerabilities, here's what actually matters to avoid burning out.
Read more →